\n tcsponsc the rxiiniiner\ Atneiuinieni m iht- Nt>tioe of Allov\<jt)ce maik-d 
Oi 27 2007 pie^st; anitud the chmn^ as toiiious 

j (Cufienfh \mcndcd) A Cdiuputei pioiiidm ptoduLl LompuMiiii a (.omputct 
pro>?rani stored (.>n a t(.>niputci vStoiage iiiodiuin uhen executed operable to tdntro! a 
comptuei u-i iiCiicune audu d^nti mdicdtuo ofa rt\iues! to CNceute a computo pfoguijii 
said coinputfi pioi:iam coinpusinji 

<0 o^nipiUf! Mjus scannot logic tcsponsiso to a i.otnputoi \nus scan toquost 
u)elud)nv> data ukut)fs)nv> j computes ille to be scanned foj computei ^ uiises for 
ptrlotninvi a computet vaus sLfin luiJ for ^'enej-Uiti^ a t.Odu tesuit 

{lO audit ddia gennatot logic separate Jroni said computei \uus ss-dimn iogK 
and being triggered l^^ said computei virus scannci iogic pn<>r t{.> sasd geneiatmg wild 
scdii jOsuU and lesponsn e to said data i Jentitv ing said (.omputet fde to bo scanned thai is 
fevcncd fumi said Cviniputei \uus stannci !oga to{ simu!tane<')usl\ pcffonning additjonai 
opoKUions in pataile! \Mtb satd computet Mais scan, said addittona! opciati^ns iiKludmg 
ideiitifsing a Kqucst to execute a computes piogiam associated with said eomputei tUc 
to be scanned (oi computei snitses b\ said tomputei vuiis st.annej iogit. and, m lesponsc 
to identUkation ofsaui lequest to execute said cuiitputej piouiam, generating audit data 
ideiitil'sing satd coiiiputci pTogt,ini[f, JLvxheiem siid audit data genciaioi logic is 
iCspoiLsne to data uientifMng one oi moie baoiied computer piogtains to uieiitifs a 
tecjucit to execute a banned C!>mputei pioiitam and 

nil ) concujjem usage logic foi poiiotming a concuuem usage che^k. foi 
identifsing a lequest to execute a fuithet computet piogiam that \sould le&ult m said 
ki!tht.T coiiiputO) pTiigjam t.ont.uiienti\ executing upon moie than a pfedetennined 
numbei ot tomputeis upon a Lomputei jiet\sojk|M|3\heiein, if said concuiient usage 
Jicck indicates) that said iei.jueii to execute said fuithct i^umpulei piogiani wouUi result m 
inoie tUaii said piedeteioiiiied iUittibei of computei s upon saul computet network 



concuuentls extfLuUng saui i\iuhei computtfi piuyiaoi ihen saui lequest to e\ecuttf said 
tfniht.T coiiipuici {niv^iaiu is dented, 

ubcieni said ptedeieiunned number \anes wuh itme 

2 (Oitiiind!) \. computer pio<iTdu-i piuduct <)S Llmmcd m cKjuh 1, \\hcii.'ui d illc 
access jcqucsttvi an <-)peiatinu s\stem tiiiiLit-rs Lienfjatum ^if s.iid Cviniputer \uus sc^sn 
request, 

3, (Caiicelled) 

\ (CuiicntK \niended) -V coti^puict pingrani piuduot dt> cfafmcd fn cUiJm \ 
\\heietn ti d jequesl to exentte <) banned ctjmptttci pioiitani is tdenntled then one oi 
n>0!C banned p[*.\ufam actions v^fe tngi^cfed, s.iid banned ptv\ufani actions including 
or njore of: 

( t } s4id ban ned computer pi ogj am ) s deleted 
(u) haid banned computet piogifmi !s disdbied. 

(m) sasti banned pjogiam js encis pted aud ieplaced bs a stub piuytatn and 
(IS ) an .ilerl indicating detecMosi of said basmed compute! ptotiram is issued 

tCuiicntK \mended) A compurei pn^giam pioduct as cSaiiiied in claim \\-^\]L 
whcietn sau! data tdenufxniti one oi more banned ct)mpt[|ei piogtains is <! peimilted 
computer ptogram bst widt an\ computet progiam not included withtn said pciinittcd 
cotnpuiei pTOgKtm list being a batiiicd comptiiei ptugidin 

6. (Cancelled) 

7. (Caiicelled) 

8 <CutientK -Vmended) A cotn purer piogram pioduct as clamicd m claini [f7"j]!, 
\>!!ctetn d usct message is di'^plaved \>!!ct! eveciitton oi said luitbet (.limputct ptogidtn is 

prevented. 



9. (Cancelled) 



1 0. {Previously Preseiited) A computer program product as claimed iii claim 1, 
\%}iefem aiceftdin ttmos saiJ pTedetoJinmeU numbot ks /cto 

1 I (()f)i,itiiil> \ coinputct piogtam pTiiduot as chumed in clami i uht-rciti sind 
audit data eeneiator iomc calculates 4 checl '^um \4lue fiom s.iid compute! fiie, '^aui 
c-hccksum <. aiuc bcmg used m jdcutificdtion of siud computcT t1te as a paittculai 
computer proQ:ra.m. 

12 K>Ti<i.uidl} \ computoi piogifuu product as cidiiued m ciaim W whcjeiu said 
audit data uciiciat!>i kmc stviict. .said calculated checksum u-ilut- and uses sasu st^^ied 
Laicuiaied chccksuin \ rdues instead ot iLcalculaUiig s<!id checLsum \dluc when said 
computei tl!e subject to a subseijuent access \sithout am mtei veiune change has ing been 
made to said computer file. 

13. (Original) A computer program product as claimed in claim 1, wherein said 
audit data generator logic is responsi ve to a non-user specified database of data indicative 
of particular computer programs. 

14, (Original) A computer program product as claimed in claim 1, wherein said 
audit data generator logic is respoiisive to a user specified database of data indiGative of 
particular computer programs. 

\ 5 (Origuial) A compute! piogiam product as churned m ciaun L \sbereui said 
computer \ irus scan request results iVoni an on-access scan 

16, (Orii^inal) A comp^^«='" progi'am product as claimed in claim 1, wherein said 
computer vtius scan request results tVom an on-demar)d scan. 
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i 7 (Ouiruial > A cuoiputer program prutiuct a.s claimed in ciauii i , whereui local 
audn J.'UdJs sioicd upon dcpmpiuei vxithtn dcofuputer ncu\oik unit! sdid cpmpiUci \i> 
pcilled b\ a lumoie compuier upon sdui compitiei nciwuik whereupon .said local audit 
data is sent to said remote computer, 

IX (Otiiiinan \ vomputci piouu^ni puuiuct as claimed m vlaim I ~ wherein vud 
Tt.mote i-OinputL't gont.iates a C(,nit>ol!ddteJ dudit lepoTt Un a pluuilit\ of onupuatt> upon 
said computer network. 

b) (( uiiend\ Amended) A method of y^neiating audit data indicatne of a 
rtqut.st 10 ext'tuic a cumputt-t pioiisati), said metliod compr istng the steps of 

{i ) iesponsn o to a ctjmputoi \ inis scan ietjuest v\!thui d compute! ^ uus 
scannt-! peifoiniinL; a ttiinputcf \u\ts scan and generatmu a scan icsult, said computet 
\ iiuh hCiii tcqiicsi mckiduiy datd identdx a cotupiiter tile to be scanned lot (.nnjputLi 
viruses; 

{lO tnggcnng operation of dn audu data geneialuf whith \b ^cpaiale fiom said 
computes \ uus scanuei, usjng saui computer \ uus scannei pnoi to said generatuig said 
scdn icsuh, said audit data geneidtoi being icbponsnc to said data idt-ntiistng ^.nd 
cuniputei nie to be scanned diat is rcceised from sdid cotnputei suus seannt-i foi 
simuitancousK pcftoimmg adumonal opetanons m paiallel unh said ct'jmputci mius 
scan s<!id addilional opeiauons including tdenufxtng a rcviuest to execute a ct)mpu{ei 
piogram associated wnh said comp^^<^^" ^^^e to be ^cail^ed tbi computei \iruses b\ said 
compuiei \uus scannerjl JJ vslieiLin said audit data guieiatoi jjhigit-1] fs responsne to 
data jdentitv sng orre (>i moie banned computei piogrami> lo identify a icqucst to cvecute a 
banned coinputci progtam,-i«i4 

(in) in icspuiKsc iv tdentirication of said iequest to execute said i^tiniputei 
piogjam genfiating audit data idetitthtng said computer piogjam, and 

peiftununii a concuiient usage check foi identifx iiig a iet.|uest to execute a 
furthei coinputer piograni that would scsuit in said turther coinputer piogram 
concufienih ese(.uting upon moie than a ptedeieiinined number uf computers upon a 
computer nct\\oik| fjl^wheiein if said c(.>ncuiient usage cttcck indicate* that *aid lequcsi 
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ro execute .saiti fintht;! computtfr proyraoi \\oiild result in more ihan said predetermined 
mmibci urconiputt.T^ upon ^<m\ computer netu oik coiicufTeiUls executing viid turthcT 
comptuei ptugram then said rtitiuiist io (ixtctue said tuiiher computei progjam ts denied, 
whtTftn ^aid predfterniined nuii)bcr\ancs whh tin^e 

20 (OnyinaB A method a.s claimed in claim l'\ whea-in a fde access retjuest to 
an opeuiting ss^teni tiiggeis genoTatioti ot\said compute? \itus scan tcqucst 

2i.fCaiicelled) 

22 ((, uuetids \mtndtd) \ method at> clamied in claun [[2 i \] wlietctn, d a 
je^uest to evecute <) banned ctjmputei piogtani is tdenntlod then one oi niojeb<inncd 
p[ou,fam actions v^fe rnggefed, s.iid banned ptv\ufani actions mciudfng vine O! nioie <.>f 

(i) Sfud ii.mned compuiei jHOLirfin) is deleted 

iu ) sdid banned computer progiam is disabled, 

(ni) haid banned progtani is encnpted and icpidc-ed b\ a stub piogiam, and 
(i^ ) 4U aieit tmltcattnti detection ot" satd banned cumputei piogiain js issued 

2'v (CuiTently Amended) A method as claimed in chiiin H- wherein said 
data identi tying one or more banned computer programs is a permitted computer pi'ogram 
list with any compufei' piogi'ain not included witiiifj said pei'mitfed compiiter piogram iisf 
being a banned computer program. 

24. (Cancelled) 

25. (Cancelled) 

26. (Ciinently Amended) A method as claimed in claim [[2.5]]i9, vvherein a user 
message is displayed when execution of said further computer prograiii is prevented. 



27. (Cancelled) 
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28, (Previously Presented) A method as claimed in claim 19, wherein at certairi 
times said predetermined .number is zero. 

29. (Original) A method as claimed in claim 19, wherein said audit data generator 
calculates a checksum value from said computer file, said checksum value being used in 
identification of said computer tile as a particular compiiter program. 

fOtigmal ) \ method as clamied m clann 2'-'^, Vvheicin said audu dfUa gcnciatoT 
stores said calcuSated checksum \ahte and uses said stored calculated checksum \aUtes 
instead of rtcaicuiaung said checksum vaiue v»hen satd computet tile subject to a 
suhse^ueni access without anx mieixeiitng change ha\ing been made io said ctmipuiei 

file. 

3 1 . (Original) .A method as claimed in claim 1 9, wherein said audit data generator 
is responsive to a non-user specified database of data indicative of particular computer 
programs. 

32 (Original ) 'V method as claimed in claim h\ wherein .said audit data geneiator 
is resp<-)nsi\e to a usei specified database !>f daut indicative of parucuiar C!>mputer 
programs. 

"^3 (Ouginal > -V metliod as claimed m chum U"*, uhncui said computer \itas S(.di! 
ietjuest lesuSts fiom an on-access scan 

34 (t>nginal) \ method as ciauned in claim 10, \sheic5ii said computei \!Tuss>.an 
tcqucst lesults iioni an on-demand scan 

3s (OiiginaD A iiicthod as claimed in cUiun wheiein local audu data is stoied 
upon a compute} uitlmi a compute} neiwork until said computei is polled b\ a icmote 
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computer upon said computer network whereupon said local audit data is sent to said 
remote computer. 

3(> (Ofigfmil) \ method as cidtincu in claim whcicfn said rcmint- dimputfi 
ticnouues d consoiidaied audit topoU toi d phiifyus orconiputejs upon vnd computet 

network, 

>~ {C'urrentlv \niended) Appataius foi generjnng audit data indicati\e ofa 
iequesl to execute a c-oniputci pTo^^jaiu, said appasatfis compii^tfi^^j 

u ) a computer vf nts scanner, responsi^'e to a computer s tras scan re(|uest, for 
pertorming a computer \ irus scan and for sooner atuii: a scan result, satd computer \ irus 
scan reviuesi uicludiULi data idonufyiULi a computet file to be ,scduned for compuier 
viruses; 

(ii) an audit data generator separate froni said coniputer virus scanner and 
being triggered by said computer viRis scanner prior to said generating said scan result, 
and responsive to said data identifying said computer tile to be scanned that is received 
from said computer virus ,scanner for simultaneously performing additional operations in 
parallel with said computer virus scan, said additional operations including 
ideiUifying a request to execute a computer piogram associated wiUi said compuier file lo 
he scanned for computer viruses by said computer virus scanner and, in response to 
identificafion of said request to execute said cornpufei' piograiu, geiieiating audit data 
identifying said computer program[|.]]^\vherein said audit data generator is responsive to 
data identify ing one or more banned comjuiter programs to identify a iequest to execute a 
banned computer program; and 

concurrent usage monitor fx>r perfornnng a concunent usage check for identifying 
a request to execute a further computer program that would sesult in said further 
computer progrant concurrendy executing upon more than a predetermined number of 
computers upon a computer network[|-. JJ^wiierein, if said cottcurrettt usage check 
indicates that said request to execute said further computer program would result in more 
tiian said predetermined number of coiuputers upon said conjputer network concurrently 
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tfxecuung saui fuUher cumputt;i proinam, then saul i'e^.|ues{ tu e'vecutt; .said rujibtfi 
compiiler proaraoi is denied; 

ubcieni said ptedeieiunned number \anes wuh itme 

J^S (OugifKy ) \ppfu<)tus chiunej ui c!<iuu 3", wbctoin a i'llv .JLcess tcqiicst to 
an <.>pfratinii sssrem tnggeis generation (■)t\said computer x'lrus sean request 

39. (Cancelled) 

40. ((Ajrrently Amended) Apparatus as claimed in claim [139]]57, wherein, if a 
request to execute a banned computer program is identified, then one or more banned 
pios^ram actions are triggered, .said banned program actions including one or more of: 

(i) said banned computer program is deleted, 

(ii) said banned coojputer program i.s disabled, 

(iii) said banned program is encrypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is .issued. 

4.{. ('Currently Amended) Apparatus as c!ai.n?ed in c!a.tm fj3'^^"j|17, wherein said 
data identifying one or more banned compirter programs is a permitted computer program 
list with any computer program not included within said permitted computer program list 
being a banned computer program, 

42. (Cancelled) 

43. (Cancelled) 

44. (Clirrently Amended) Apparatus as claimed in claim [[43]]37, wherein a user 
message ts displayed when execution of said further cottiputer program ts prevented. 



45. (C^ancelled) 
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46. (Pieviousiy Presented) Apparatus as clainied in cSaim 37, wherein at certain 
times said predetermined number is zero. 

■i" (Orignial) \pparsuus a;, ciatmed tn cfaim 37. \shcfCJn Ssiici audit dat^i generator 
Lak'uiaie\ <) chev.'Lsuni \<ih\v tioni satd conipmci ilie ydid checksiini xaiuo bi^mu. used ui 
identificatnw ot^said ctwiputer tile as a partfculai tvmputer pfourani 

4^ {Original) \ppataius as cianned in ciasm 47 \sherem satd .lutitt data gener.itor 
slufes said calculated cficeksuni \diuc and uses sajd slufed calculated cficeksuni \diucs 
instead of recalcuiaring said checksum value when said computer tile subject to a 
subsequent access without an> imei'\enin_i> change basins^ been made to said con^putet 
li!e. 

49. (Original) Apparattis as claimed in ciaitn 37, wherein said audit data generator 
is responsive to a non-user specified database of data indicative of paniciilar computer 
progi'a.ms. 

(Ottginal) Vpparatus as c!din?ed in ciatni i7 whetcin saui audit data genet alor 
is ifsponsue to a user spccdkd dulabase of data mdicatisc of paiucuiat coinputei 
programs. 

^ S (Onginai) Appatatus as ciaimed in clamt ?7 wherein said coniputes virus scan 
iLtjUL'^t tesuits iiom an on-access scan 

^2 (Ongmal) Appatatiis astlaimcd in Uann uherein satd coinputei muis scan 
request results from an on-demand scan. 

53 (Ottginal) Apparatus as chiimeJ in ciatni 3"", whctcin iueal audit data ts stored 
upon a ctwtputer within a computer network until said ctwtputet is polled bs a i'emt-)te 
comptiit'i upon sdid ciHnputcr network \>!!eicup4m said local audii data is sent to said 
remote computer. 
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54, (Previously Presented) Apparatus as claimed in claim 53, wherein said remote 
compiiter generates a coiisolidated audit report for a plyraHty of compiiters upon said 
computer network. 

55. -57. (Canceiled) 

5^ {Pre\iousi> Presented) A computer program product as ciaimeti in claim I 
uhcreiii •<<iki computer virus scannei loyic tieueratcs said scan result aftci fceci\iiiga 
repSv from said audit data generator logic 

50 {Previtnisly Presented) .-X ctjmputci progiani product as claimed ui claim I 
uiierein said computer \irus scannei k>i:ic L;t*tu*rates said scan result as a function .i 
xcph from said audiL data iicneraLor logic 

60 (Previously Picsented} A computei progiani product as claimed in claim I, 
whereui a repiv from said audit data generator logjc is not tised by said computer s irus 
seamier logic if said scan result uicludes a failure 

ol iousiv Presented) A computet program product as claimed in claim L 
wlicreui said data identitxiiig said coniputci iilc is sent to said audit data geuerator k)gic 
prior to peifomiing said computer vims scan. 



